feat(provision): idempotent setup for local dev and remote server

justfile

@@ -11,6 +11,13 @@ default:
 setup:
     @bash scripts/setup-dev.sh
 
+# One-shot provisioning for a fresh clone: app/.env + APP_KEY (idempotent, never
+# overwrites an existing key), composer deps, npm deps, DB schema + migrations,
+# and a first-admin-password check. Prefer this over the stale `setup` recipe.
+[group('dev')]
+provision:
+    @bash scripts/provision.sh
+
 # One-shot build of all frontend assets (run before `dev` if sources changed)
 [group('dev')]
 dev-build:
@@ -484,6 +491,26 @@ deploy-migrate-storage dry_run='' target_host='xamxam':
 deploy-all-first: deploy deploy-backup deploy-cleanup-cron deploy-logrotate
     # One-shot: full initial deploy including backup and cleanup cron jobs.
 
+# One-shot remote provisioning for a fresh xamxam server.
+# Chains: server .env/APP_KEY (idempotent, never overwrites an existing key) →
+# full deploy → nginx → backup + cleanup + logrotate, then prints the
+# first-admin and service-credential follow-ups.
+[group('deploy')]
+provision-server:
+    @bash scripts/provision-server-env.sh xamxam
+    @just deploy
+    @just deploy-nginx
+    @just deploy-backup
+    @just deploy-cleanup-cron
+    @just deploy-logrotate
+    @echo ""
+    @echo "✅ Server provisioning complete."
+    @echo ""
+    @echo "Next, from the server's /admin/account:"
+    @echo "  1. Set the admin password (fresh DB starts unauthenticated)"
+    @echo "  2. Configure SMTP + PeerTube credentials (stored encrypted in the DB)"
+    @echo "     and verify Nextcloud sync in /admin"
+
 # ============================================================================
 # Testing
 # ============================================================================